* feat: 离线计算图片密钥
* fix(find_all_keys): address review feedback on #69
Apply 5 fixes per @ylytdeng's review:
- find_xor_key: return None when last-byte ^ 0xD9 doesn't match the
first-byte-derived xor_key (was returning xor_key in both branches,
so the validation was a no-op)
- multiprocessing cleanup: split single-line terminate, add
p.join(timeout=1) loop to avoid orphan workers
- replace 3 bare `except:` with `except Exception:` so KeyboardInterrupt
can break the brute-force loop
- add actionable hint ("请先在微信中查看 2-3 张图片") when xor_key or
ciphertext can't be derived from attach_dir
- drop try/except ImportError fallback on `from Crypto.Cipher import AES`
(and the now-dead `if not AES` guards); pycryptodome is already a hard
dependency elsewhere in the project
Original algorithm and multiprocessing implementation by @H3CoF6 in #69.
Review by @ylytdeng: https://github.com/ylytdeng/wechat-decrypt/pull/69
Co-authored-by: H3CoF6 <190114211+H3CoF6@users.noreply.github.com>
---------
Co-authored-by: Belugary <53219544+Belugary@users.noreply.github.com>
Co-authored-by: H3CoF6 <190114211+H3CoF6@users.noreply.github.com>
- Add Linux memory scanner (`find_all_keys_linux.py`) using `/proc/<pid>/mem`,
same approach as Windows/macOS — no GDB, no function offsets, no restart needed
- Extract Windows-specific code to `find_all_keys_windows.py`
- Make `find_all_keys.py` a platform dispatcher (Windows / Linux)
- Add `key_utils.py` for cross-platform path matching (`/` vs `\` in all_keys.json)
- Update `config.py` with Linux auto-detection of db_storage paths
- Update all consumers (decrypt_db, monitor, monitor_web, mcp_server) to use
`get_key_info()` for platform-agnostic key lookup
Tested on remote Linux container: 15/15 DBs scanned, decrypted, and verified.
Add main.py as single entry point that auto-detects config, extracts keys, and launches Web UI or decrypts databases in one command.
Refactor find_all_keys to scan all Weixin.exe processes instead of only the largest one, enabling multi=account support.
